initUpload/storeChunk cast a missing cryptifytoken header to string

[dobby-coder]

Both places where the SDK reads Cryptify's rolling upload token cast a possibly-null header to string:

• src/api/cryptify.ts:122 — initUpload: const token = response.headers.get('cryptifytoken') as string;
• src/api/cryptify.ts:222 — storeChunk: same cast

Headers.get() returns null when the header is absent. The most likely way that happens in a browser is a Cryptify deployment (or a proxy in front of it) that doesn't list cryptifytoken in Access-Control-Expose-Headers — the response is a 200, but the header is invisible to the SDK.

What the caller sees today: state.token becomes null, the next chunk PUT sends cryptifytoken: null as a literal string, and Cryptify rejects it with a token mismatch. The surfaced error points at chunk upload, several steps away from the actual cause. The same silent null can also be written into a FileState the consumer persists for resumeUpload.

Fix: after each headers.get('cryptifytoken'), throw a NetworkError naming the missing header and the CORS-exposure cause instead of casting. Add unit tests in tests/api.test.ts for a 200 init response and a 200 chunk response that carry no cryptifytoken header.

[dobby-coder]

/dobby fix — in src/api/cryptify.ts, replace the response.headers.get('cryptifytoken') as string casts at lines 122 (initUpload) and 222 (storeChunk) with an explicit null check that throws a NetworkError naming the missing header and the likely Access-Control-Expose-Headers cause. Add regression tests in tests/api.test.ts covering a 200 init response and a 200 chunk response with no cryptifytoken header. Run npm run typecheck and npm test. Conventional-commit PR title required.

[dobby-coder]

On it! I'll update src/api/cryptify.ts so initUpload (line 122) and storeChunk (line 222) explicitly check for a missing cryptifytoken response header and throw a NetworkError calling out the header name and the likely Access-Control-Expose-Headers misconfiguration, instead of blindly casting it. I'll also add regression tests in tests/api.test.ts for 200 responses missing that header, then run npm run typecheck and npm test before opening a PR with a conventional-commit title.

[dobby-coder]

Parked: this is dobby-initiated work coupled to @rubenhensen, who already has 4 dobby PRs waiting for review (budget: 3). I'm not opening another one until some of those merge or close — comment here to re-trigger dobby once there's room.